Browser Side Text Input State Tracking for OOPIF.

content/browser/site_per_process_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/site_per_process_browsertest.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 13 matching lines @@
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/frame_host/render_widget_host_view_child_frame.h"
 #include "content/browser/gpu/compositor_util.h"
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 #include "content/browser/renderer_host/input/synthetic_tap_gesture.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
-#include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/frame_messages.h"
 #include "content/common/input/synthetic_tap_gesture_params.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/cert_store.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/resource_dispatcher_host.h"
 #include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/test_utils.h"
-#include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
 #include "content/test/test_frame_navigation_observer.h"
 #include "ipc/ipc_security_test_util.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "third_party/WebKit/public/web/WebSandboxFlags.h"
 #include "ui/events/event.h"
 #include "ui/events/event_utils.h"
 #include "ui/gfx/geometry/point.h"
@@ skipping 564 matching lines @@
 };
 
 // Ensure that navigating subframes in --site-per-process mode works and the
 // correct documents are committed.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, CrossSiteIframe) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a,a(a,a(a)))"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   // Load same-site page into iframe.
   FrameTreeNode* child = root->child_at(0);
   GURL http_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
   NavigateFrameToURL(child, http_url);
   EXPECT_EQ(http_url, observer.last_navigation_url());
   EXPECT_TRUE(observer.last_navigation_succeeded());
   {
     // There should be only one RenderWidgetHost when there are no
     // cross-process iframes.
     std::set<RenderWidgetHostView*> views_set =
-        static_cast<WebContentsImpl*>(shell()->web_contents())
-            ->GetRenderWidgetHostViewsInTree();
+        web_contents()->GetRenderWidgetHostViewsInTree();
     EXPECT_EQ(1U, views_set.size());
   }
 
   EXPECT_EQ(
       " Site A\n"
       "   |--Site A\n"
       "   +--Site A\n"
       "        |--Site A\n"
       "        +--Site A\n"
       "             +--Site A\n"
@@ skipping 12 matching lines @@
   SiteInstance* site_instance = child->current_frame_host()->GetSiteInstance();
   RenderViewHost* rvh = child->current_frame_host()->render_view_host();
   RenderProcessHost* rph = child->current_frame_host()->GetProcess();
   EXPECT_NE(shell()->web_contents()->GetRenderViewHost(), rvh);
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(), site_instance);
   EXPECT_NE(shell()->web_contents()->GetRenderProcessHost(), rph);
   {
     // There should be now two RenderWidgetHosts, one for each process
     // rendering a frame.
     std::set<RenderWidgetHostView*> views_set =
-        static_cast<WebContentsImpl*>(shell()->web_contents())
-            ->GetRenderWidgetHostViewsInTree();
+        web_contents()->GetRenderWidgetHostViewsInTree();
     EXPECT_EQ(2U, views_set.size());
   }
   RenderFrameProxyHost* proxy_to_parent =
       child->render_manager()->GetProxyToParent();
   EXPECT_TRUE(proxy_to_parent);
   EXPECT_TRUE(proxy_to_parent->cross_process_frame_connector());
   // The out-of-process iframe should have its own RenderWidgetHost,
   // independent of any RenderViewHost.
   EXPECT_NE(
       rvh->GetWidget()->GetView(),
@@ skipping 26 matching lines @@
   EXPECT_NE(rvh, child->current_frame_host()->render_view_host());
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             child->current_frame_host()->GetSiteInstance());
   EXPECT_NE(site_instance,
             child->current_frame_host()->GetSiteInstance());
   EXPECT_NE(shell()->web_contents()->GetRenderProcessHost(),
             child->current_frame_host()->GetProcess());
   EXPECT_NE(rph, child->current_frame_host()->GetProcess());
   {
     std::set<RenderWidgetHostView*> views_set =
-        static_cast<WebContentsImpl*>(shell()->web_contents())
-            ->GetRenderWidgetHostViewsInTree();
+        web_contents()->GetRenderWidgetHostViewsInTree();
     EXPECT_EQ(2U, views_set.size());
   }
   EXPECT_EQ(proxy_to_parent, child->render_manager()->GetProxyToParent());
   EXPECT_TRUE(proxy_to_parent->cross_process_frame_connector());
   EXPECT_NE(
       child->current_frame_host()->render_view_host()->GetWidget()->GetView(),
       proxy_to_parent->cross_process_frame_connector()->get_view_for_testing());
   EXPECT_TRUE(child->current_frame_host()->GetRenderWidgetHost());
 
   EXPECT_EQ(
@@ skipping 46 matching lines @@
 #else
 #define MAYBE_NestedSurfaceHitTestTest NestedSurfaceHitTestTest
 #endif
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        MAYBE_NestedSurfaceHitTestTest) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_positioned_nested_frames.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(1U, root->child_count());
 
   FrameTreeNode* parent_iframe_node = root->child_at(0);
   GURL site_url(embedded_test_server()->GetURL(
       "a.com", "/frame_tree/page_with_positioned_frame.html"));
   EXPECT_EQ(site_url, parent_iframe_node->current_url());
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             parent_iframe_node->current_frame_host()->GetSiteInstance());
 
   FrameTreeNode* nested_iframe_node = parent_iframe_node->child_at(0);
   GURL nested_site_url(
       embedded_test_server()->GetURL("baz.com", "/title1.html"));
   EXPECT_EQ(nested_site_url, nested_iframe_node->current_url());
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             nested_iframe_node->current_frame_host()->GetSiteInstance());
   EXPECT_NE(parent_iframe_node->current_frame_host()->GetSiteInstance(),
             nested_iframe_node->current_frame_host()->GetSiteInstance());
 
   // Create listeners for mouse events.
   RenderWidgetHostMouseEventMonitor main_frame_monitor(
       root->current_frame_host()->GetRenderWidgetHost());
   RenderWidgetHostMouseEventMonitor nested_frame_monitor(
       nested_iframe_node->current_frame_host()->GetRenderWidgetHost());
 
   RenderWidgetHostInputEventRouter* router =
-      static_cast<WebContentsImpl*>(shell()->web_contents())
-          ->GetInputEventRouter();
+      web_contents()->GetInputEventRouter();
 
   RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
       root->current_frame_host()->GetRenderWidgetHost()->GetView());
   RenderWidgetHostViewBase* rwhv_nested =
       static_cast<RenderWidgetHostViewBase*>(
           nested_iframe_node->current_frame_host()
               ->GetRenderWidgetHost()
               ->GetView());
 
   SurfaceHitTestReadyNotifier notifier(
@@ skipping 31 matching lines @@
 #else
 #define MAYBE_SurfaceHitTestPointerEventsNone SurfaceHitTestPointerEventsNone
 #endif
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        MAYBE_SurfaceHitTestPointerEventsNone) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_positioned_frame_pointer-events_none.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(1U, root->child_count());
 
   FrameTreeNode* child_node = root->child_at(0);
   GURL site_url(embedded_test_server()->GetURL("baz.com", "/title1.html"));
   EXPECT_EQ(site_url, child_node->current_url());
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             child_node->current_frame_host()->GetSiteInstance());
 
   // Create listeners for mouse events.
   RenderWidgetHostMouseEventMonitor main_frame_monitor(
       root->current_frame_host()->GetRenderWidgetHost());
   RenderWidgetHostMouseEventMonitor child_frame_monitor(
       child_node->current_frame_host()->GetRenderWidgetHost());
 
   RenderWidgetHostInputEventRouter* router =
-      static_cast<WebContentsImpl*>(shell()->web_contents())
-          ->GetInputEventRouter();
+      web_contents()->GetInputEventRouter();
 
   RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
       root->current_frame_host()->GetRenderWidgetHost()->GetView());
   RenderWidgetHostViewBase* rwhv_child = static_cast<RenderWidgetHostViewBase*>(
       child_node->current_frame_host()->GetRenderWidgetHost()->GetView());
 
   SurfaceHitTestReadyNotifier notifier(
       static_cast<RenderWidgetHostViewChildFrame*>(rwhv_child));
   notifier.WaitForSurfaceReady();
 
@@ skipping 22 matching lines @@
 #else
 #define MAYBE_CompositorFrameSwapped CompositorFrameSwapped
 #endif
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        MAYBE_CompositorFrameSwapped) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(baz)"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(1U, root->child_count());
 
   FrameTreeNode* child_node = root->child_at(0);
   GURL site_url(embedded_test_server()->GetURL(
       "baz.com", "/cross_site_iframe_factory.html?baz()"));
   EXPECT_EQ(site_url, child_node->current_url());
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             child_node->current_frame_host()->GetSiteInstance());
   RenderWidgetHostViewBase* rwhv_base = static_cast<RenderWidgetHostViewBase*>(
       child_node->current_frame_host()->GetRenderWidgetHost()->GetView());
@@ skipping 10 matching lines @@
   }
 }
 
 // Ensure that OOPIFs are deleted after navigating to a new main frame.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, CleanupCrossSiteIframe) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a,a(a,a(a)))"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   // Load a cross-site page into both iframes.
   GURL foo_url = embedded_test_server()->GetURL("foo.com", "/title2.html");
   NavigateFrameToURL(root->child_at(0), foo_url);
   EXPECT_TRUE(observer.last_navigation_succeeded());
   EXPECT_EQ(foo_url, observer.last_navigation_url());
   NavigateFrameToURL(root->child_at(1), foo_url);
   EXPECT_TRUE(observer.last_navigation_succeeded());
@@ skipping 36 matching lines @@
   EXPECT_FALSE(RenderViewHost::FromID(subframe_process_id, subframe_rvh_id));
 }
 
 // Ensure that root frames cannot be detached.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, RestrictFrameDetach) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a,a(a,a(a)))"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   // Load cross-site pages into both iframes.
   GURL foo_url = embedded_test_server()->GetURL("foo.com", "/title2.html");
   NavigateFrameToURL(root->child_at(0), foo_url);
   EXPECT_TRUE(observer.last_navigation_succeeded());
   EXPECT_EQ(foo_url, observer.last_navigation_url());
   GURL bar_url = embedded_test_server()->GetURL("bar.com", "/title2.html");
   NavigateFrameToURL(root->child_at(1), bar_url);
@@ skipping 41 matching lines @@
       "      C = http://bar.com/",
       DepictFrameTree(root));
 }
 
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigateRemoteFrame) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a,a(a,a(a)))"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   // Load same-site page into iframe.
   FrameTreeNode* child = root->child_at(0);
   GURL http_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
   NavigateFrameToURL(child, http_url);
   EXPECT_EQ(http_url, observer.last_navigation_url());
   EXPECT_TRUE(observer.last_navigation_succeeded());
 
@@ skipping 46 matching lines @@
             child->current_frame_host()->GetSiteInstance());
 }
 
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        NavigateRemoteFrameToBlankAndDataURLs) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a,a(a))"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   // Load same-site page into iframe.
   FrameTreeNode* child = root->child_at(0);
   GURL http_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
   NavigateFrameToURL(child, http_url);
   EXPECT_EQ(http_url, observer.last_navigation_url());
   EXPECT_TRUE(observer.last_navigation_succeeded());
   EXPECT_EQ(
@@ skipping 85 matching lines @@
 //
 // Note that due to http://crbug.com/450681, node2 cannot be re-navigated to
 // site B and stays in not rendered state.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        NavigateRemoteFrameToKilledProcess) {
   GURL main_url(embedded_test_server()->GetURL(
       "foo.com", "/cross_site_iframe_factory.html?foo.com(bar.com, foo.com)"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
   ASSERT_EQ(2U, root->child_count());
 
   // Make sure node2 points to the correct cross-site page.
   GURL site_b_url = embedded_test_server()->GetURL(
       "bar.com", "/cross_site_iframe_factory.html?bar.com()");
   FrameTreeNode* node2 = root->child_at(0);
   EXPECT_EQ(site_b_url, node2->current_url());
 
@@ skipping 28 matching lines @@
 //
 // Note that due to http://crbug.com/450681, node2 cannot be re-navigated to
 // site B and stays in not rendered state.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        NavigateRemoteFrameToKilledProcessWithSubtree) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(bar(baz), a)"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   TestNavigationObserver observer(shell()->web_contents());
 
   ASSERT_EQ(2U, root->child_count());
 
   GURL site_b_url(embedded_test_server()->GetURL(
       "bar.com", "/cross_site_iframe_factory.html?bar(baz())"));
   // We can't use a TestNavigationObserver to verify the URL here,
   // since the frame has children that may have clobbered it in the observer.
   EXPECT_EQ(site_b_url, root->child_at(0)->current_url());
 
@@ skipping 64 matching lines @@
 
 // Ensure that the renderer process doesn't crash when the main frame navigates
 // a remote child to a page that results in a network error.
 // See https://crbug.com/558016.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigateRemoteAfterError) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a)"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Load same-site page into iframe.
   {
     TestNavigationObserver observer(shell()->web_contents());
     FrameTreeNode* child = root->child_at(0);
     GURL http_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
     NavigateFrameToURL(child, http_url);
     EXPECT_EQ(http_url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     observer.Wait();
@@ skipping 33 matching lines @@
 // successfully loads after earlier encountering a network error for it.
 // See https://crbug.com/560511.
 // TODO(creis): Make the net error page show in the correct process as well,
 // per https://crbug.com/588314.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ProcessTransferAfterError) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   FrameTreeNode* child = root->child_at(0);
   GURL url_a = child->current_url();
 
   // Disable host resolution in the test server and try to navigate the subframe
   // cross-site, which will lead to a committed net error (which looks like
   // success to the TestNavigationObserver).
   GURL url_b = embedded_test_server()->GetURL("b.com", "/title3.html");
   host_resolver()->ClearRules();
   TestNavigationObserver observer(shell()->web_contents());
   NavigateIframeToURL(shell()->web_contents(), "child-0", url_b);
@@ skipping 81 matching lines @@
 // verifying that a proxy for node 4 has been recreated in process B.  This
 // verifies the fix for https://crbug.com/478892.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        NavigatingToKilledProcessRestoresAllProxies) {
   // Navigate to a page with three frames: one cross-site and two same-site.
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/frame_tree/page_with_three_frames.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   TestNavigationObserver observer(shell()->web_contents());
 
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   |--Site B ------- proxies for A\n"
       "   |--Site A ------- proxies for B\n"
       "   +--Site A ------- proxies for B\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/",
       DepictFrameTree(root));
@@ skipping 42 matching lines @@
 // process A, and then checks that process B isn't resurrected to create a
 // proxy for the new child frame.  See https://crbug.com/476846.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        CreateChildFrameAfterKillingProcess) {
   // Navigate to a page with three frames: one cross-site and two same-site.
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/frame_tree/page_with_three_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   |--Site B ------- proxies for A\n"
       "   |--Site A ------- proxies for B\n"
       "   +--Site A ------- proxies for B\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/",
       DepictFrameTree(root));
   SiteInstance* b_site_instance =
@@ skipping 54 matching lines @@
 // for which its parent has proxies.  This includes A.  However, even though
 // process A is live (step 4), the parent proxy in A is not live (which was
 // incorrectly assumed previously).  This is because step 4 does not resurrect
 // proxies for popups opened before the crash.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        CreateChildFrameAfterKillingOpener) {
   GURL main_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   SiteInstance* site_instance_a = root->current_frame_host()->GetSiteInstance();
 
   // Open a popup and navigate it cross-process to b.com.
   ShellAddedObserver new_shell_observer;
   EXPECT_TRUE(ExecuteScript(root->current_frame_host(),
                             "popup = window.open('about:blank');"));
   Shell* popup = new_shell_observer.GetShell();
   GURL popup_url(embedded_test_server()->GetURL("b.com", "/title2.html"));
   EXPECT_TRUE(NavigateToURL(popup, popup_url));
 
@@ skipping 65 matching lines @@
 // node1 is the root.
 // Initially, both node1.proxy_hosts_ and node3.proxy_hosts_ contain C.
 // After we kill B, make sure proxies for C are cleared.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        KillingRendererClearsDescendantProxies) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/frame_tree/page_with_two_frames_nested.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(2U, root->child_count());
 
   GURL site_b_url(
       embedded_test_server()->GetURL(
           "bar.com", "/frame_tree/page_with_one_frame.html"));
   // We can't use a TestNavigationObserver to verify the URL here,
   // since the frame has children that may have clobbered it in the observer.
   EXPECT_EQ(site_b_url, root->child_at(0)->current_url());
 
   // Ensure that a new process is created for node2.
@@ skipping 51 matching lines @@
 }
 
 // Crash a subframe and ensures its children are cleared from the FrameTree.
 // See http://crbug.com/338508.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, CrashSubframe) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   NavigateToURL(shell(), main_url);
 
   // Check the subframe process.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   +--Site B ------- proxies for A\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/",
       DepictFrameTree(root));
   FrameTreeNode* child = root->child_at(0);
   EXPECT_TRUE(
       child->current_frame_host()->render_view_host()->IsRenderViewLive());
   EXPECT_TRUE(child->current_frame_host()->IsRenderFrameLive());
@@ skipping 40 matching lines @@
 // When a new subframe is added, related SiteInstances that can reach the
 // subframe should create proxies for it (https://crbug.com/423587).  This test
 // checks that if A embeds B and later adds a new subframe A2, A2 gets a proxy
 // in B's process.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, CreateProxiesForNewFrames) {
   GURL main_url(embedded_test_server()->GetURL(
       "b.com", "/frame_tree/page_with_one_frame.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(1U, root->child_count());
 
   // Make sure the frame starts out at the correct cross-site URL.
   EXPECT_EQ(embedded_test_server()->GetURL("baz.com", "/title1.html"),
             root->child_at(0)->current_url());
 
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   +--Site B ------- proxies for A\n"
       "Where A = http://b.com/\n"
@@ skipping 222 matching lines @@
 
 // Ensure that when navigating a frame cross-process RenderFrameProxyHosts are
 // created in the FrameTree skipping the subtree of the navigating frame.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        ProxyCreationSkipsSubtree) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a,a(a,a(a)))"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   EXPECT_TRUE(root->child_at(1) != NULL);
   EXPECT_EQ(2U, root->child_at(1)->child_count());
 
   {
     // Load same-site page into iframe.
     TestNavigationObserver observer(shell()->web_contents());
     GURL http_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
     NavigateFrameToURL(root->child_at(0), http_url);
     EXPECT_EQ(http_url, observer.last_navigation_url());
@@ skipping 125 matching lines @@
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        MAYBE_FrameOwnerPropertiesPropagationScrolling) {
 #if defined(OS_MACOSX)
   ui::test::ScopedPreferredScrollerStyle scroller_style_override(false);
 #endif
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/frame_owner_properties_scrolling.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(1u, root->child_count());
 
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   +--Site B ------- proxies for A\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/",
       DepictFrameTree(root));
 
   FrameTreeNode* child = root->child_at(0);
@@ skipping 45 matching lines @@
 
 // Verify that "marginwidth" and "marginheight" properties on frame elements
 // propagate to child frames correctly.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        FrameOwnerPropertiesPropagationMargin) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/frame_owner_properties_margin.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(1u, root->child_count());
 
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   +--Site B ------- proxies for A\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/",
       DepictFrameTree(root));
 
   FrameTreeNode* child = root->child_at(0);
@@ skipping 66 matching lines @@
   }
 }
 
 // Verify origin replication with an A-embed-B-embed-C-embed-A hierarchy.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, OriginReplication) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b(c(a),b), a)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   EXPECT_EQ(
       " Site A ------------ proxies for B C\n"
       "   |--Site B ------- proxies for A C\n"       // tiptop_child
       "   |    |--Site C -- proxies for A B\n"       // middle_child
       "   |    |    +--Site A -- proxies for B C\n"  // lowest_child
       "   |    +--Site B -- proxies for A C\n"
       "   +--Site A ------- proxies for B C\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/\n"
@@ skipping 68 matching lines @@
       &result));
   EXPECT_EQ(a_origin, result + "/");
 }
 
 // Check that iframe sandbox flags are replicated correctly.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, SandboxFlagsReplication) {
   GURL main_url(embedded_test_server()->GetURL("/sandboxed_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   // Navigate the second (sandboxed) subframe to a cross-site page with a
   // subframe.
   GURL foo_url(
       embedded_test_server()->GetURL("foo.com", "/frame_tree/1-1.html"));
   NavigateFrameToURL(root->child_at(1), foo_url);
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
@@ skipping 77 matching lines @@
   EXPECT_EQ(main_url.GetOrigin().spec(), result + "/");
 }
 
 // Check that dynamic updates to iframe sandbox flags are propagated correctly.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, DynamicSandboxFlags) {
   GURL main_url(
       embedded_test_server()->GetURL("/frame_tree/page_with_two_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
   ASSERT_EQ(2U, root->child_count());
 
   // Make sure first frame starts out at the correct cross-site page.
   EXPECT_EQ(embedded_test_server()->GetURL("bar.com", "/title1.html"),
             root->child_at(0)->current_url());
 
   // Navigate second frame to another cross-site page.
   GURL baz_url(embedded_test_server()->GetURL("baz.com", "/title1.html"));
@@ skipping 101 matching lines @@
 }
 
 // Check that dynamic updates to iframe sandbox flags are propagated correctly.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        DynamicSandboxFlagsRemoteToLocal) {
   GURL main_url(
       embedded_test_server()->GetURL("/frame_tree/page_with_two_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
   ASSERT_EQ(2U, root->child_count());
 
   // Make sure the two frames starts out at correct URLs.
   EXPECT_EQ(embedded_test_server()->GetURL("bar.com", "/title1.html"),
             root->child_at(0)->current_url());
   EXPECT_EQ(embedded_test_server()->GetURL("/title1.html"),
             root->child_at(1)->current_url());
 
@@ skipping 47 matching lines @@
 }
 
 // Check that dynamic updates to iframe sandbox flags are propagated correctly.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        DynamicSandboxFlagsRendererInitiatedNavigation) {
   GURL main_url(
       embedded_test_server()->GetURL("/frame_tree/page_with_one_frame.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
   ASSERT_EQ(1U, root->child_count());
 
   // Make sure the frame starts out at the correct cross-site page.
   EXPECT_EQ(embedded_test_server()->GetURL("baz.com", "/title1.html"),
             root->child_at(0)->current_url());
 
   // The frame should not be sandboxed to start with.
   EXPECT_EQ(blink::WebSandboxFlags::None,
@@ skipping 58 matching lines @@
 // checking whether the grandchild frame added in step 3 sees proper sandbox
 // flags and origin for its (remote) parent.  This wasn't addressed when
 // https://crbug.com/423587 was fixed.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        ProxiesForNewChildFramesHaveCorrectReplicationState) {
   GURL main_url(
       embedded_test_server()->GetURL("/frame_tree/page_with_one_frame.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   TestNavigationObserver observer(shell()->web_contents());
 
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   +--Site B ------- proxies for A\n"
       "Where A = http://127.0.0.1/\n"
       "      B = http://baz.com/",
       DepictFrameTree(root));
 
   // In the root frame, add a new sandboxed local frame, which itself has a
@@ skipping 58 matching lines @@
   EXPECT_TRUE(success);
   EXPECT_EQ(1u, Shell::windows().size());
 }
 
 // Verify that a child frame can retrieve the name property set by its parent.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, WindowNameReplication) {
   GURL main_url(embedded_test_server()->GetURL("/frame_tree/2-4.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   // Load cross-site page into iframe.
   GURL frame_url =
       embedded_test_server()->GetURL("foo.com", "/frame_tree/3-1.html");
   NavigateFrameToURL(root->child_at(0), frame_url);
   EXPECT_TRUE(observer.last_navigation_succeeded());
   EXPECT_EQ(frame_url, observer.last_navigation_url());
 
@@ skipping 10 matching lines @@
   EXPECT_EQ("3-1-name", result);
 }
 
 // Verify that dynamic updates to a frame's window.name propagate to the
 // frame's proxies, so that the latest frame names can be used in navigations.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, DynamicWindowName) {
   GURL main_url(embedded_test_server()->GetURL("/frame_tree/2-4.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   TestNavigationObserver observer(shell()->web_contents());
 
   // Load cross-site page into iframe.
   GURL frame_url =
       embedded_test_server()->GetURL("foo.com", "/frame_tree/3-1.html");
   NavigateFrameToURL(root->child_at(0), frame_url);
   EXPECT_TRUE(observer.last_navigation_succeeded());
   EXPECT_EQ(frame_url, observer.last_navigation_url());
 
   // Browser process should know the child frame's original window.name
@@ skipping 36 matching lines @@
 }
 
 // Verify that when a frame is navigated to a new origin, the origin update
 // propagates to the frame's proxies.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, OriginUpdatesReachProxies) {
   GURL main_url(
       embedded_test_server()->GetURL("/frame_tree/page_with_two_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   TestNavigationObserver observer(shell()->web_contents());
 
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   |--Site B ------- proxies for A\n"
       "   +--Site A ------- proxies for B\n"
       "Where A = http://127.0.0.1/\n"
       "      B = http://bar.com/",
       DepictFrameTree(root));
 
@@ skipping 30 matching lines @@
       << frame_origin << ")";
 }
 
 // Ensure that navigating subframes in --site-per-process mode properly fires
 // the DidStopLoading event on WebContentsObserver.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, CrossSiteDidStopLoading) {
   GURL main_url(embedded_test_server()->GetURL("/site_per_process_main.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   // Load same-site page into iframe.
   FrameTreeNode* child = root->child_at(0);
   GURL http_url(embedded_test_server()->GetURL("/title1.html"));
   NavigateFrameToURL(child, http_url);
   EXPECT_EQ(http_url, observer.last_navigation_url());
   EXPECT_TRUE(observer.last_navigation_succeeded());
 
@@ skipping 13 matching lines @@
 
 // Ensure that the renderer does not crash when navigating a frame that has a
 // sibling RemoteFrame.  See https://crbug.com/426953.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        NavigateWithSiblingRemoteFrame) {
   GURL main_url(
       embedded_test_server()->GetURL("/frame_tree/page_with_two_frames.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   TestNavigationObserver observer(shell()->web_contents());
 
   // Make sure the first frame is out of process.
   ASSERT_EQ(2U, root->child_count());
   FrameTreeNode* node2 = root->child_at(0);
   EXPECT_NE(root->current_frame_host()->GetSiteInstance(),
             node2->current_frame_host()->GetSiteInstance());
 
   // Make sure the second frame is in the parent's process.
   FrameTreeNode* node3 = root->child_at(1);
@@ skipping 13 matching lines @@
 // Ensure that the renderer does not crash when a local frame with a remote
 // parent frame is swapped from local to remote, then back to local again.
 // See https://crbug.com/585654.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        NavigateSiblingsToSameProcess) {
   GURL main_url(
       embedded_test_server()->GetURL("/frame_tree/page_with_two_frames.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   FrameTreeNode* node2 = root->child_at(0);
   FrameTreeNode* node3 = root->child_at(1);
 
   // Navigate the second iframe to the same process as the first.
   GURL frame_url = embedded_test_server()->GetURL("bar.com", "/title1.html");
   NavigateFrameToURL(node3, frame_url);
 
   // Verify that they are in the same process.
   EXPECT_EQ(node2->current_frame_host()->GetSiteInstance(),
@@ skipping 24 matching lines @@
   {
     GURL main_url(
         embedded_test_server()->GetURL("/frame_with_load_event.html"));
     base::string16 expected_title(base::UTF8ToUTF16("LOADED"));
     TitleWatcher title_watcher(shell()->web_contents(), expected_title);
     EXPECT_TRUE(NavigateToURL(shell(), main_url));
     EXPECT_EQ(title_watcher.WaitAndGetTitle(), expected_title);
   }
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Load another cross-site page into the iframe and check that the load event
   // is fired.
   {
     GURL foo_url(embedded_test_server()->GetURL("foo.com", "/title1.html"));
     base::string16 expected_title(base::UTF8ToUTF16("LOADEDLOADED"));
     TitleWatcher title_watcher(shell()->web_contents(), expected_title);
     TestNavigationObserver observer(shell()->web_contents());
     NavigateFrameToURL(root->child_at(0), foo_url);
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_EQ(foo_url, observer.last_navigation_url());
     EXPECT_EQ(title_watcher.WaitAndGetTitle(), expected_title);
   }
 }
 
 // Check that postMessage can be routed between cross-site iframes.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, SubframePostMessage) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_post_message_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   ASSERT_EQ(2U, root->child_count());
 
   // Verify the frames start at correct URLs.  First frame should be
   // same-site; second frame should be cross-site.
   GURL same_site_url(embedded_test_server()->GetURL("/post_message.html"));
   EXPECT_EQ(same_site_url, root->child_at(0)->current_url());
   GURL foo_url(embedded_test_server()->GetURL("foo.com",
                                               "/post_message.html"));
   EXPECT_EQ(foo_url, root->child_at(1)->current_url());
@@ skipping 25 matching lines @@
 
 // Check that postMessage can be sent from a subframe on a cross-process opener
 // tab, and that its event.source points to a valid proxy.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        PostMessageWithSubframeOnOpenerChain) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/frame_tree/page_with_post_message_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   ASSERT_EQ(2U, root->child_count());
 
   // Verify the initial state of the world.  First frame should be same-site;
   // second frame should be cross-site.
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   |--Site A ------- proxies for B\n"
       "   +--Site B ------- proxies for A\n"
       "Where A = http://a.com/\n"
@@ skipping 88 matching lines @@
 
 // Check that parent.frames[num] references correct sibling frames when the
 // parent is remote.  See https://crbug.com/478792.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, IndexedFrameAccess) {
   // Start on a page with three same-site subframes.
   GURL main_url(
       embedded_test_server()->GetURL("a.com", "/frame_tree/top.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(3U, root->child_count());
   FrameTreeNode* child0 = root->child_at(0);
   FrameTreeNode* child1 = root->child_at(1);
   FrameTreeNode* child2 = root->child_at(2);
 
   // Send each of the frames to a different site.  Each new renderer will first
   // create proxies for the parent and two sibling subframes and then create
   // and insert the new RenderFrame into the frame tree.
   GURL b_url(embedded_test_server()->GetURL("b.com", "/post_message.html"));
   GURL c_url(embedded_test_server()->GetURL("c.com", "/post_message.html"));
@@ skipping 49 matching lines @@
   EXPECT_EQ(1, GetReceivedMessages(child0));
   EXPECT_EQ(2, GetReceivedMessages(child1));
   EXPECT_EQ(1, GetReceivedMessages(child2));
 }
 
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, RFPHDestruction) {
   GURL main_url(embedded_test_server()->GetURL("/site_per_process_main.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   // Load cross-site page into iframe.
   FrameTreeNode* child = root->child_at(0);
   GURL url = embedded_test_server()->GetURL("foo.com", "/title2.html");
   NavigateFrameToURL(root->child_at(0), url);
   EXPECT_TRUE(observer.last_navigation_succeeded());
   EXPECT_EQ(url, observer.last_navigation_url());
   EXPECT_EQ(
@@ skipping 38 matching lines @@
       "Where A = http://127.0.0.1/",
       DepictFrameTree(root));
 }
 
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, OpenPopupWithRemoteParent) {
   GURL main_url(
       embedded_test_server()->GetURL("a.com", "/site_per_process_main.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Navigate first child cross-site.
   GURL frame_url(embedded_test_server()->GetURL("b.com", "/title1.html"));
   NavigateFrameToURL(root->child_at(0), frame_url);
 
   // Open a popup from the first child.
   Shell* new_shell = OpenPopup(root->child_at(0)->current_frame_host(),
                                GURL(url::kAboutBlankURL), "");
   EXPECT_TRUE(new_shell);
 
@@ skipping 81 matching lines @@
 
 // Verify that named frames are discoverable from their opener's ancestors.
 // See https://crbug.com/511474.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        DiscoverNamedFrameFromAncestorOfOpener) {
   GURL main_url(
       embedded_test_server()->GetURL("a.com", "/site_per_process_main.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Navigate first child cross-site.
   GURL frame_url(embedded_test_server()->GetURL("b.com", "/title1.html"));
   NavigateFrameToURL(root->child_at(0), frame_url);
 
   // Open a popup named "foo" from the first child.
   Shell* foo_shell = OpenPopup(root->child_at(0)->current_frame_host(),
                                GURL(url::kAboutBlankURL), "foo");
   EXPECT_TRUE(foo_shell);
 
@@ skipping 30 matching lines @@
 // still be discoverable from its opener's ancestors.  Also, instead of using
 // an opener's ancestor, this test uses a popup with same origin as that
 // ancestor. See https://crbug.com/511474.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        DiscoverFrameAfterSettingWindowName) {
   GURL main_url(
       embedded_test_server()->GetURL("a.com", "/site_per_process_main.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Open a same-site popup from the main frame.
   GURL a_com_url(embedded_test_server()->GetURL("a.com", "/title3.html"));
   Shell* a_com_shell =
       OpenPopup(root->child_at(0)->current_frame_host(), a_com_url, "");
   EXPECT_TRUE(a_com_shell);
 
   // Navigate first child on main frame cross-site.
   GURL frame_url(embedded_test_server()->GetURL("b.com", "/title1.html"));
   NavigateFrameToURL(root->child_at(0), frame_url);
@@ skipping 37 matching lines @@
 //  ^                    |
 //  +--------------------+
 //
 // The sites are carefully set up so that both opener updates are cross-process
 // but still allowed by Blink's navigation checks.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, UpdateSubframeOpener) {
   GURL main_url = embedded_test_server()->GetURL(
       "foo.com", "/frame_tree/page_with_two_frames.html");
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   EXPECT_EQ(2U, root->child_count());
 
   // From the top frame, open a popup and navigate it to a cross-site page with
   // two subframes.
   Shell* popup_shell =
       OpenPopup(shell()->web_contents(), GURL(url::kAboutBlankURL), "popup");
   EXPECT_TRUE(popup_shell);
   GURL popup_url(embedded_test_server()->GetURL(
       "bar.com", "/frame_tree/page_with_post_message_frames.html"));
   NavigateToURL(popup_shell, popup_url);
@@ skipping 52 matching lines @@
 
 // Check that when a subframe navigates to a new SiteInstance, the new
 // SiteInstance will get a proxy for the opener of subframe's parent.  I.e.,
 // accessing parent.opener from the subframe should still work after a
 // cross-process navigation.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        NavigatingSubframePreservesOpenerInParent) {
   GURL main_url = embedded_test_server()->GetURL("a.com", "/post_message.html");
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Open a popup with a cross-site page that has a subframe.
   GURL popup_url(embedded_test_server()->GetURL(
       "b.com", "/cross_site_iframe_factory.html?b(b)"));
   Shell* popup_shell = OpenPopup(shell()->web_contents(), popup_url, "popup");
   EXPECT_TRUE(popup_shell);
   FrameTreeNode* popup_root =
       static_cast<WebContentsImpl*>(popup_shell->web_contents())
           ->GetFrameTree()
           ->root();
@@ skipping 24 matching lines @@
   EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
 }
 
 // Check that if a subframe has an opener, that opener is preserved when the
 // subframe navigates cross-site.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigateSubframeWithOpener) {
   GURL main_url(embedded_test_server()->GetURL(
       "foo.com", "/frame_tree/page_with_two_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   |--Site B ------- proxies for A\n"
       "   +--Site A ------- proxies for B\n"
       "Where A = http://foo.com/\n"
       "      B = http://bar.com/",
       DepictFrameTree(root));
 
   // Update the first (cross-site) subframe's opener to root frame.
   bool success = false;
@@ skipping 44 matching lines @@
 // RenderFrameProxy is created for that subframe in another renderer process.
 // Similar to NavigateSubframeWithOpener, but this test verifies the subframe
 // opener plumbing for FrameMsg_NewFrameProxy, whereas
 // NavigateSubframeWithOpener targets FrameMsg_NewFrame.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        NewRenderFrameProxyPreservesOpener) {
   GURL main_url(
       embedded_test_server()->GetURL("foo.com", "/post_message.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Open a popup with a cross-site page that has two subframes.
   GURL popup_url(embedded_test_server()->GetURL(
       "bar.com", "/frame_tree/page_with_post_message_frames.html"));
   Shell* popup_shell = OpenPopup(shell()->web_contents(), popup_url, "popup");
   EXPECT_TRUE(popup_shell);
   FrameTreeNode* popup_root =
       static_cast<WebContentsImpl*>(popup_shell->web_contents())
           ->GetFrameTree()
           ->root();
@@ skipping 64 matching lines @@
         DISABLED_RenderViewHostPendingDeletionIsNotReused
 #else
 #define MAYBE_RenderViewHostPendingDeletionIsNotReused \
         RenderViewHostPendingDeletionIsNotReused
 #endif
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        MAYBE_RenderViewHostPendingDeletionIsNotReused) {
   GURL a_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
   NavigateToURL(shell(), a_url);
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   RenderFrameHostImpl* rfh = root->current_frame_host();
   RenderViewHostImpl* rvh = rfh->render_view_host();
   int rvh_routing_id = rvh->GetRoutingID();
   SiteInstanceImpl* site_instance = rfh->GetSiteInstance();
   RenderFrameDeletedObserver deleted_observer(rfh);
 
   // Install a BrowserMessageFilter to drop SwapOut ACK messages in A's
   // process.
   scoped_refptr<SwapoutACKMessageFilter> filter = new SwapoutACKMessageFilter();
   rfh->GetProcess()->AddFilter(filter.get());
@@ skipping 76 matching lines @@
 // Check that when a cross-process frame acquires focus, the old focused frame
 // loses focus and fires blur events.  Starting on a page with a cross-site
 // subframe, simulate mouse clicks to switch focus from root frame to subframe
 // and then back to root frame.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        CrossProcessFocusChangeFiresBlurEvents) {
   GURL main_url(
       embedded_test_server()->GetURL("a.com", "/page_with_input_field.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   +--Site B ------- proxies for A\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/",
       DepictFrameTree(root));
 
   // Focus the main frame's text field.  The return value "input-focus"
   // indicates that the focus event was fired correctly.
@@ skipping 39 matching lines @@
 
 // Check that when a cross-process subframe is focused, its parent's
 // document.activeElement correctly returns the corresponding <iframe> element.
 // The test sets up an A-embed-B-embed-C page and shifts focus A->B->A->C,
 // checking document.activeElement after each change.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, DocumentActiveElement) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b(c))"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   EXPECT_EQ(
       " Site A ------------ proxies for B C\n"
       "   +--Site B ------- proxies for A C\n"
       "        +--Site C -- proxies for A B\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/\n"
       "      C = http://c.com/",
       DepictFrameTree(root));
 
@@ skipping 56 matching lines @@
 // The test builds a page with four cross-site frames and then focuses them one
 // by one, checking the value of document.hasFocus() in all frames.  For any
 // given focused frame, document.hasFocus() should return true for that frame
 // and all its ancestor frames.
 // Disabled due to flakes; see https://crbug.com/559273.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, DISABLED_DocumentHasFocus) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b(c),d)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   EXPECT_EQ(
       " Site A ------------ proxies for B C D\n"
       "   |--Site B ------- proxies for A C D\n"
       "   |    +--Site C -- proxies for A B D\n"
       "   +--Site D ------- proxies for A B C\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/\n"
       "      C = http://c.com/\n"
       "      D = http://d.com/",
@@ skipping 45 matching lines @@
   EXPECT_FALSE(document_has_focus(grandchild));
   EXPECT_TRUE(document_has_focus(child2));
 }
 
 // Check that window.focus works for cross-process subframes.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, SubframeWindowFocus) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b,c)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   EXPECT_EQ(
       " Site A ------------ proxies for B C\n"
       "   |--Site B ------- proxies for A C\n"
       "   +--Site C ------- proxies for A B\n"
       "Where A = http://a.com/\n"
       "      B = http://b.com/\n"
       "      C = http://c.com/",
       DepictFrameTree(root));
 
@@ skipping 116 matching lines @@
 
 // Verify that we receive a mouse cursor update message when we mouse over
 // a text field contained in an out-of-process iframe.
 // Fails under TSan.  http://crbug.com/545237
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        DISABLED_CursorUpdateFromReceivedFromCrossSiteIframe) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_positioned_frame.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   FrameTreeNode* child_node = root->child_at(0);
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             child_node->current_frame_host()->GetSiteInstance());
 
   scoped_refptr<CursorMessageFilter> filter = new CursorMessageFilter();
   child_node->current_frame_host()->GetProcess()->AddFilter(filter.get());
 
   // Send a MouseMove to the subframe. The frame contains text, and moving the
   // mouse over it should cause the renderer to send a mouse cursor update.
   blink::WebMouseEvent mouse_event;
   mouse_event.type = blink::WebInputEvent::MouseMove;
   mouse_event.x = 60;
   mouse_event.y = 60;
   RenderWidgetHost* rwh_child =
       root->child_at(0)->current_frame_host()->GetRenderWidgetHost();
   RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
       root->current_frame_host()->GetRenderWidgetHost()->GetView());
-  static_cast<WebContentsImpl*>(shell()->web_contents())
-      ->GetInputEventRouter()
-      ->RouteMouseEvent(root_view, &mouse_event);
+  web_contents()->GetInputEventRouter()->RouteMouseEvent(root_view,
+                                                         &mouse_event);
 
   // CursorMessageFilter::Wait() implicitly tests whether we receive a
   // ViewHostMsg_SetCursor message from the renderer process, because it does
   // does not return otherwise.
   filter->Wait();
   EXPECT_EQ(filter->last_set_cursor_routing_id(), rwh_child->GetRoutingID());
 }
 #endif
 
 // Tests that we are using the correct RenderFrameProxy when navigating an
@@ skipping 22 matching lines @@
 #if defined(USE_AURA)
 // Browser process hit testing is not implemented on Android, and this test
 // requires Aura for RenderWidgetHostViewAura::OnTouchEvent().
 // https://crbug.com/491334
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        SubframeTouchEventRouting) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_positioned_nested_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(shell()->web_contents());
-  FrameTreeNode* root = web_contents->GetFrameTree()->root();
+  WebContentsImpl* contents = web_contents();
+  FrameTreeNode* root = contents->GetFrameTree()->root();
   ASSERT_EQ(1U, root->child_count());
 
   GURL frame_url(
       embedded_test_server()->GetURL("b.com", "/page_with_touch_handler.html"));
   NavigateFrameToURL(root->child_at(0), frame_url);
 
   // Synchronize with the child and parent renderers to guarantee that the
   // surface information required for event hit testing is ready.
   RenderWidgetHostViewBase* child_rwhv = static_cast<RenderWidgetHostViewBase*>(
       root->child_at(0)->current_frame_host()->GetView());
   SurfaceHitTestReadyNotifier notifier(
       static_cast<RenderWidgetHostViewChildFrame*>(child_rwhv));
   notifier.WaitForSurfaceReady();
 
   // Simulate touch event to sub-frame.
   gfx::Point child_center(150, 150);
   auto rwhv = static_cast<RenderWidgetHostViewAura*>(
-      web_contents->GetRenderWidgetHostView());
+      contents->GetRenderWidgetHostView());
   ui::TouchEvent touch_event(ui::ET_TOUCH_PRESSED, child_center, 0, 0,
                              ui::EventTimeForNow(), 30.f, 30.f, 0.f, 0.f);
   rwhv->OnTouchEvent(&touch_event);
 
   // Verify touch handler in subframe was invoked
   std::string result;
   EXPECT_TRUE(ExecuteScriptAndExtractString(
       root->child_at(0)->current_frame_host(),
       "window.domAutomationController.send(getLastTouchEvent());", &result));
   EXPECT_EQ("touchstart", result);
@@ skipping 15 matching lines @@
 #define MAYBE_SubframeGestureEventRouting DISABLED_SubframeGestureEventRouting
 #else
 #define MAYBE_SubframeGestureEventRouting SubframeGestureEventRouting
 #endif
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        MAYBE_SubframeGestureEventRouting) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_positioned_nested_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(shell()->web_contents());
-  FrameTreeNode* root = web_contents->GetFrameTree()->root();
+  WebContentsImpl* contents = web_contents();
+  FrameTreeNode* root = contents->GetFrameTree()->root();
   ASSERT_EQ(1U, root->child_count());
 
   GURL frame_url(
       embedded_test_server()->GetURL("b.com", "/page_with_click_handler.html"));
   NavigateFrameToURL(root->child_at(0), frame_url);
   auto child_frame_host = root->child_at(0)->current_frame_host();
 
   // Synchronize with the child and parent renderers to guarantee that the
   // surface information required for event hit testing is ready.
   RenderWidgetHostViewBase* child_rwhv = static_cast<RenderWidgetHostViewBase*>(
@@ skipping 112 matching lines @@
 }
 
 }  // namespace anonymous
 
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        InputEventRouterGestureTargetQueueTest) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_positioned_nested_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(shell()->web_contents());
-  FrameTreeNode* root = web_contents->GetFrameTree()->root();
+  WebContentsImpl* contents = web_contents();
+
+  FrameTreeNode* root = contents->GetFrameTree()->root();
   ASSERT_EQ(1U, root->child_count());
 
   GURL frame_url(
       embedded_test_server()->GetURL("b.com", "/page_with_click_handler.html"));
   NavigateFrameToURL(root->child_at(0), frame_url);
   auto child_frame_host = root->child_at(0)->current_frame_host();
 
   // Synchronize with the child and parent renderers to guarantee that the
   // surface information required for event hit testing is ready.
   auto rwhv_child =
       static_cast<RenderWidgetHostViewBase*>(child_frame_host->GetView());
   SurfaceHitTestReadyNotifier notifier(
       static_cast<RenderWidgetHostViewChildFrame*>(rwhv_child));
   notifier.WaitForSurfaceReady();
 
   // All touches & gestures are sent to the main frame's view, and should be
   // routed appropriately from there.
   auto rwhv_parent = static_cast<RenderWidgetHostViewBase*>(
-      web_contents->GetRenderWidgetHostView());
+      contents->GetRenderWidgetHostView());
 
-  RenderWidgetHostInputEventRouter* router =
-      web_contents->GetInputEventRouter();
+  RenderWidgetHostInputEventRouter* router = contents->GetInputEventRouter();
   EXPECT_TRUE(router->gesture_target_queue_.empty());
   EXPECT_EQ(nullptr, router->gesture_target_);
 
   // Send touch sequence to main-frame.
   gfx::Point main_frame_point(25, 25);
   SendTouchTapWithExpectedTarget(rwhv_parent, main_frame_point,
                                  router->touch_target_, rwhv_parent);
   EXPECT_EQ(1LU, router->gesture_target_queue_.size());
   EXPECT_EQ(nullptr, router->gesture_target_);
 
@@ skipping 43 matching lines @@
 #endif  // defined(USE_AURA)
 
 // Ensure that a cross-process subframe can receive keyboard events when in
 // focus. Flaky: https://crbug.com/596508.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        DISABLED_SubframeKeyboardEventRouting) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/frame_tree/page_with_one_frame.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(shell()->web_contents());
-  FrameTreeNode* root = web_contents->GetFrameTree()->root();
+  WebContentsImpl* contents = web_contents();
+  FrameTreeNode* root = contents->GetFrameTree()->root();
 
   GURL frame_url(
       embedded_test_server()->GetURL("b.com", "/page_with_input_field.html"));
   NavigateFrameToURL(root->child_at(0), frame_url);
 
   // Focus the subframe and then its input field.  The return value
   // "input-focus" will be sent once the input field's focus event fires.
   FocusFrame(root->child_at(0));
   std::string result;
   EXPECT_TRUE(ExecuteScriptAndExtractString(
       root->child_at(0)->current_frame_host(), "focusInputField()", &result));
   EXPECT_EQ(result, "input-focus");
 
   // The subframe should now be focused.
   EXPECT_EQ(root->child_at(0), root->frame_tree()->GetFocusedFrame());
 
   // Generate a few keyboard events and route them to currently focused frame.
-  SimulateKeyPress(web_contents, ui::VKEY_F, false, false, false, false);
-  SimulateKeyPress(web_contents, ui::VKEY_O, false, false, false, false);
-  SimulateKeyPress(web_contents, ui::VKEY_O, false, false, false, false);
+  SimulateKeyPress(contents, ui::VKEY_F, false, false, false, false);
+  SimulateKeyPress(contents, ui::VKEY_O, false, false, false, false);
+  SimulateKeyPress(contents, ui::VKEY_O, false, false, false, false);
 
   // Verify that the input field in the subframe received the keystrokes.
   EXPECT_TRUE(ExecuteScriptAndExtractString(
       root->child_at(0)->current_frame_host(),
       "window.domAutomationController.send(getInputFieldText());", &result));
   EXPECT_EQ("FOO", result);
 }
 
 // Ensure that sequential focus navigation (advancing focused elements with
 // <tab> and <shift-tab>) works across cross-process subframes.
@@ skipping 122 matching lines @@
 #define MAYBE_CreateContextMenuTest DISABLED_CreateContextMenuTest
 #else
 #define MAYBE_CreateContextMenuTest CreateContextMenuTest
 #endif
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, MAYBE_CreateContextMenuTest) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_positioned_frame.html"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(1U, root->child_count());
 
   FrameTreeNode* child_node = root->child_at(0);
   GURL site_url(embedded_test_server()->GetURL("baz.com", "/title1.html"));
   EXPECT_EQ(site_url, child_node->current_url());
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             child_node->current_frame_host()->GetSiteInstance());
 
   RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
       root->current_frame_host()->GetRenderWidgetHost()->GetView());
@@ skipping 12 matching lines @@
     base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
         FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
     run_loop.Run();
   }
 
   // A WebContentsDelegate to listen for the ShowContextMenu message.
   ContextMenuObserverDelegate context_menu_delegate;
   shell()->web_contents()->SetDelegate(&context_menu_delegate);
 
   RenderWidgetHostInputEventRouter* router =
-      static_cast<WebContentsImpl*>(shell()->web_contents())
-          ->GetInputEventRouter();
+      web_contents()->GetInputEventRouter();
 
   // Target right-click event to child frame.
   blink::WebMouseEvent click_event;
   click_event.type = blink::WebInputEvent::MouseDown;
   click_event.button = blink::WebPointerProperties::ButtonRight;
   click_event.x = 75;
   click_event.y = 75;
   click_event.clickCount = 1;
   router->RouteMouseEvent(root_view, &click_event);
 
@@ skipping 438 matching lines @@
 // if a pending cross-process navigation is cancelled. The test works by trying
 // to create a new RenderFrame with the same routing id. If there is an
 // entry with the same routing ID, a CHECK is hit and the process crashes.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        SubframePendingAndBackToSameSiteInstance) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   NavigateToURL(shell(), main_url);
 
   // Capture the FrameTreeNode this test will be navigating.
-  FrameTreeNode* node = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root()
-                            ->child_at(0);
+  FrameTreeNode* node = web_contents()->GetFrameTree()->root()->child_at(0);
   EXPECT_TRUE(node);
   EXPECT_NE(node->current_frame_host()->GetSiteInstance(),
             node->parent()->current_frame_host()->GetSiteInstance());
 
   // Navigate to the site of the parent, but to a page that will not commit.
   GURL same_site_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
   NavigationStallDelegate stall_delegate(same_site_url);
   ResourceDispatcherHost::Get()->SetDelegate(&stall_delegate);
   {
     NavigationController::LoadURLParams params(same_site_url);
@@ skipping 53 matching lines @@
 
 // This test ensures that the RenderFrame isn't leaked in the renderer process
 // when a remote parent detaches a child frame. The test works by trying
 // to create a new RenderFrame with the same routing id. If there is an
 // entry with the same routing ID, a CHECK is hit and the process crashes.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ParentDetachRemoteChild) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b,b)"));
   NavigateToURL(shell(), main_url);
 
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(shell()->web_contents());
-  EXPECT_EQ(2U, web_contents->GetFrameTree()->root()->child_count());
+  WebContentsImpl* contents = web_contents();
+  EXPECT_EQ(2U, contents->GetFrameTree()->root()->child_count());
 
   // Capture the FrameTreeNode this test will be navigating.
-  FrameTreeNode* node = web_contents->GetFrameTree()->root()->child_at(0);
+  FrameTreeNode* node = contents->GetFrameTree()->root()->child_at(0);
   EXPECT_TRUE(node);
   EXPECT_NE(node->current_frame_host()->GetSiteInstance(),
             node->parent()->current_frame_host()->GetSiteInstance());
 
   // Grab the routing id of the first child RenderFrameHost and set up a process
   // observer to ensure there is no crash when a new RenderFrame creation is
   // attempted.
   RenderProcessHost* process = node->current_frame_host()->GetProcess();
   RenderProcessHostWatcher watcher(
       process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
   int frame_routing_id = node->current_frame_host()->GetRoutingID();
   int widget_routing_id =
       node->current_frame_host()->GetRenderWidgetHost()->GetRoutingID();
   int parent_routing_id =
       node->parent()->render_manager()->GetRoutingIdForSiteInstance(
           node->current_frame_host()->GetSiteInstance());
 
   // Have the parent frame remove the child frame from its DOM. This should
   // result in the child RenderFrame being deleted in the remote process.
-  EXPECT_TRUE(ExecuteScript(web_contents,
+  EXPECT_TRUE(ExecuteScript(contents,
                             "document.body.removeChild("
                             "document.querySelectorAll('iframe')[0])"));
-  EXPECT_EQ(1U, web_contents->GetFrameTree()->root()->child_count());
+  EXPECT_EQ(1U, contents->GetFrameTree()->root()->child_count());
 
   {
     FrameMsg_NewFrame_Params params;
     params.routing_id = frame_routing_id;
     params.proxy_routing_id = MSG_ROUTING_NONE;
     params.opener_routing_id = MSG_ROUTING_NONE;
     params.parent_routing_id = parent_routing_id;
     params.previous_sibling_routing_id = MSG_ROUTING_NONE;
     params.widget_params.routing_id = widget_routing_id;
     params.widget_params.hidden = true;
     params.replication_state.name = "name";
     params.replication_state.unique_name = "name";
 
     process->Send(new FrameMsg_NewFrame(params));
   }
 
   // The test must wait for the process to exit, but if there is no leak, the
   // RenderFrame will be properly created and there will be no crash.
   // Therefore, navigate the remaining subframe to completely different site,
   // which will cause the original process to exit cleanly.
-  NavigateFrameToURL(
-      web_contents->GetFrameTree()->root()->child_at(0),
-      embedded_test_server()->GetURL("d.com", "/title3.html"));
+  NavigateFrameToURL(contents->GetFrameTree()->root()->child_at(0),
+                     embedded_test_server()->GetURL("d.com", "/title3.html"));
   watcher.Wait();
   EXPECT_TRUE(watcher.did_exit_normally());
 }
 
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, VisibilityChanged) {
   GURL main_url(
       embedded_test_server()->GetURL("a.com", "/page_with_iframe.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
   EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(), main_url);
 
   GURL cross_site_url =
       embedded_test_server()->GetURL("oopif.com", "/title1.html");
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   TestNavigationObserver observer(shell()->web_contents());
 
   NavigateFrameToURL(root->child_at(0), cross_site_url);
   EXPECT_EQ(cross_site_url, observer.last_navigation_url());
   EXPECT_TRUE(observer.last_navigation_succeeded());
 
   RenderWidgetHostImpl* render_widget_host =
       root->child_at(0)->current_frame_host()->GetRenderWidgetHost();
   EXPECT_FALSE(render_widget_host->is_hidden());
@@ skipping 17 matching lines @@
 }
 
 // Verify that sandbox flags inheritance works across multiple levels of
 // frames.  See https://crbug.com/576845.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, SandboxFlagsInheritance) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a)"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Set sandbox flags for child frame.
   EXPECT_TRUE(ExecuteScript(
       root->current_frame_host(),
       "document.querySelector('iframe').sandbox = 'allow-scripts';"));
 
   // Calculate expected flags.  Note that "allow-scripts" resets both
   // WebSandboxFlags::Scripts and WebSandboxFlags::AutomaticFeatures bits per
   // blink::parseSandboxPolicy().
   blink::WebSandboxFlags expected_flags =
@@ skipping 32 matching lines @@
 // a child frame, update its sandbox flags but don't navigate the frame, and
 // ensure that a new cross-site grandchild frame doesn't inherit the new flags
 // (which shouldn't have taken effect).
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        SandboxFlagsNotInheritedBeforeNavigation) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a)"));
   NavigateToURL(shell(), main_url);
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Set sandbox flags for child frame.
   EXPECT_TRUE(ExecuteScript(
       root->current_frame_host(),
       "document.querySelector('iframe').sandbox = 'allow-scripts';"));
 
   // These flags should be pending but not take effect, since there's been no
   // navigation.
   blink::WebSandboxFlags expected_flags =
       blink::WebSandboxFlags::All & ~blink::WebSandboxFlags::Scripts &
@@ skipping 29 matching lines @@
 // Verify that popups opened from sandboxed frames inherit sandbox flags from
 // their opener, and that they keep these inherited flags after being navigated
 // cross-site.  See https://crbug.com/483584.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        NewPopupInheritsSandboxFlagsFromOpener) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Set sandbox flags for child frame.
   EXPECT_TRUE(ExecuteScript(root->current_frame_host(),
                             "document.querySelector('iframe').sandbox = "
                             "    'allow-scripts allow-popups';"));
 
   // Calculate expected flags.  Note that "allow-scripts" resets both
   // WebSandboxFlags::Scripts and WebSandboxFlags::AutomaticFeatures bits per
   // blink::parseSandboxPolicy().
   blink::WebSandboxFlags expected_flags =
@@ skipping 48 matching lines @@
 // Verify that popups opened from frames sandboxed with the
 // "allow-popups-to-escape-sandbox" directive do *not* inherit sandbox flags
 // from their opener.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        OpenUnsandboxedPopupFromSandboxedFrame) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Set sandbox flags for child frame, specifying that popups opened from it
   // should not be sandboxed.
   EXPECT_TRUE(ExecuteScript(
       root->current_frame_host(),
       "document.querySelector('iframe').sandbox = "
       "    'allow-scripts allow-popups allow-popups-to-escape-sandbox';"));
 
   // Set expected flags for the child frame.  Note that "allow-scripts" resets
   // both WebSandboxFlags::Scripts and WebSandboxFlags::AutomaticFeatures bits
@@ skipping 48 matching lines @@
   SetupCrossSiteRedirector(&https_server);
 
   GURL iframe_url(
       https_server.GetURL("/mixed-content/basic-passive-in-iframe.html"));
   EXPECT_TRUE(NavigateToURL(shell(), iframe_url));
   EXPECT_TRUE(shell()->web_contents()->DisplayedInsecureContent());
 
   // When the subframe navigates, the WebContents should still be marked
   // as having displayed insecure content.
   GURL navigate_url(https_server.GetURL("/title1.html"));
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   NavigateFrameToURL(root->child_at(0), navigate_url);
   EXPECT_TRUE(shell()->web_contents()->DisplayedInsecureContent());
 
   // When the main frame navigates, it should no longer be marked as
   // displaying insecure content.
   EXPECT_TRUE(
       NavigateToURL(shell(), https_server.GetURL("b.com", "/title1.html")));
   EXPECT_FALSE(shell()->web_contents()->DisplayedInsecureContent());
 }
 
 // Tests that, when a parent frame is set to strictly block mixed
 // content via Content Security Policy, child OOPIFs cannot display
 // mixed content.
 IN_PROC_BROWSER_TEST_F(SitePerProcessIgnoreCertErrorsBrowserTest,
                        PassiveMixedContentInIframeWithStrictBlocking) {
   net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
   https_server.ServeFilesFromSourceDirectory("content/test/data");
   ASSERT_TRUE(https_server.Start());
   SetupCrossSiteRedirector(&https_server);
 
   GURL iframe_url_with_strict_blocking(https_server.GetURL(
       "/mixed-content/basic-passive-in-iframe-with-strict-blocking.html"));
   EXPECT_TRUE(NavigateToURL(shell(), iframe_url_with_strict_blocking));
   EXPECT_FALSE(shell()->web_contents()->DisplayedInsecureContent());
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   EXPECT_TRUE(root->current_replication_state()
                   .should_enforce_strict_mixed_content_checking);
   EXPECT_TRUE(root->child_at(0)
                   ->current_replication_state()
                   .should_enforce_strict_mixed_content_checking);
 
   // When the subframe navigates, it should still be marked as enforcing
   // strict mixed content.
   GURL navigate_url(https_server.GetURL("/title1.html"));
   NavigateFrameToURL(root->child_at(0), navigate_url);
@@ skipping 18 matching lines @@
 IN_PROC_BROWSER_TEST_F(SitePerProcessIgnoreCertErrorsBrowserTest,
                        ActiveMixedContentInIframe) {
   net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
   https_server.ServeFilesFromSourceDirectory("content/test/data");
   ASSERT_TRUE(https_server.Start());
   SetupCrossSiteRedirector(&https_server);
 
   GURL iframe_url(
       https_server.GetURL("/mixed-content/basic-active-in-iframe.html"));
   EXPECT_TRUE(NavigateToURL(shell(), iframe_url));
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   ASSERT_EQ(1U, root->child_count());
   FrameTreeNode* mixed_child = root->child_at(0)->child_at(0);
   ASSERT_TRUE(mixed_child);
   // The child iframe attempted to create a mixed iframe; this should
   // have been blocked, so the mixed iframe should not have committed a
   // load.
   EXPECT_FALSE(mixed_child->has_committed_real_load());
 }
 
 // Test setting a cross-origin iframe to display: none.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, CrossSiteIframeDisplayNone) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   NavigateToURL(shell(), main_url);
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   RenderWidgetHost* root_render_widget_host =
       root->current_frame_host()->GetRenderWidgetHost();
 
   // Set the iframe to display: none.
   EXPECT_TRUE(
       ExecuteScript(shell()->web_contents(),
                     "document.querySelector('iframe').style.display = 'none'"));
 
   // Waits until pending frames are done.
   scoped_ptr<MainThreadFrameObserver> observer(
       new MainThreadFrameObserver(root_render_widget_host));
   observer->Wait();
 
   // Force the renderer to generate a new frame.
   EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
                             "document.body.style.background = 'black'"));
 
   // Waits for the next frame.
   observer->Wait();
 }
 
+// This class will sniff incoming IPC for ViewHostMsg_TextInputStateChanged.
+class TextInputStateChangedMessageFilter : public BrowserMessageFilter {
+ public:
+  explicit TextInputStateChangedMessageFilter(
+      RenderWidgetHostImpl* render_widget_host)
+      : BrowserMessageFilter(ViewMsgStart), text_input_state_changed_(false) {
+    if (!render_widget_host || !render_widget_host->GetProcess())
+      text_input_state_changed_ = true;
+    old_state = *render_widget_host->GetView()->text_input_state();
+    render_widget_host->GetProcess()->AddFilter(this);
+  }
+
+  void WaitUntilTextInputStateChanges() {
+    if (!text_input_state_changed_) {
+      message_loop_runner_ = new MessageLoopRunner;
+      message_loop_runner_->Run();
+    }
+  }
+
+ private:
+  ~TextInputStateChangedMessageFilter() override {}
+
+  bool OnMessageReceived(const IPC::Message& msg) override {
+    IPC_BEGIN_MESSAGE_MAP(TextInputStateChangedMessageFilter, msg)
+      IPC_MESSAGE_HANDLER(ViewHostMsg_TextInputStateChanged,
+                          OnTextInputStateChangedMessageReceived)
+    IPC_END_MESSAGE_MAP()
+    return false;
+  }
+
+  void OnTextInputStateChangedMessageReceived(const TextInputState& new_state) {
+    if (new_state.type != old_state.type || new_state.mode != old_state.mode ||
+        new_state.value != old_state.value) {
+      text_input_state_changed_ = true;
+      if (message_loop_runner_)
+        BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
+                                message_loop_runner_->QuitClosure());
+    }
+  }
+
+  bool text_input_state_changed_;
+  scoped_refptr<MessageLoopRunner> message_loop_runner_;
+  TextInputState old_state;
+
+  DISALLOW_COPY_AND_ASSIGN(TextInputStateChangedMessageFilter);
+};
+
+// Verify that when moving the focus between different frames, the WebContents
+// properly keeps track of the text input state.
+// The test loads a page with one input field, two out of process frames, and a
+// second input field positioned after the last <iframe>. Then a sequence of TAB
+// inputs are faked to navigate focus in between the different <input> elements.
+// After each change, we check with the RWHV of the frame as well as the
+// WebContents to make sure the text input state is as expected.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, TextInputStateChanged) {
+  GURL main_page_url(embedded_test_server()->GetURL(
+      "a.com", "/textinput/page_with_input_iframeX2_input.html"));
+  NavigateToURL(shell(), main_page_url);
+
+  WebContents* contents = shell()->web_contents();
+
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+
+  FrameTreeNode* child_b = root->child_at(0);
+  GURL child_b_url(embedded_test_server()->GetURL(
+      "b.com", "/textinput/page_with_input.html"));
+  NavigateFrameToURL(child_b, child_b_url);
+  EXPECT_TRUE(WaitForRenderFrameReady(child_b->current_frame_host()));
+
+  FrameTreeNode* child_c = root->child_at(1);
+  GURL child_c_url(embedded_test_server()->GetURL(
+      "c.com", "/textinput/page_with_input.html"));
+  NavigateFrameToURL(child_c, child_c_url);
+  EXPECT_TRUE(WaitForRenderFrameReady(child_c->current_frame_host()));
+
+  RenderWidgetHostImpl* root_rwh =
+      root->current_frame_host()->GetRenderWidgetHost();
+  RenderWidgetHostViewBase* root_rwhv = root_rwh->GetView();
+
+  RenderWidgetHostImpl* child_b_rwh =
+      child_b->current_frame_host()->GetRenderWidgetHost();
+  RenderWidgetHostViewBase* child_b_rwhv = child_b_rwh->GetView();
+
+  RenderWidgetHostImpl* child_c_rwh =
+      child_c->current_frame_host()->GetRenderWidgetHost();
+  RenderWidgetHostViewBase* child_c_rwhv = child_c_rwh->GetView();
+
+  // Change the text value in <input> field of either frame so that we can
+  // later track the changes.
+  EXPECT_TRUE(
+      ExecuteScript(child_b->current_frame_host(),
+                    "document.querySelector('input').value = 'second';"));
+  EXPECT_TRUE(
+      ExecuteScript(child_c->current_frame_host(),
+                    "document.querySelector('input').value = 'third';"));
+
+  // Verfy the input type is none in the begning.
+  EXPECT_EQ(ui::TEXT_INPUT_TYPE_NONE, root_rwhv->text_input_state()->type);
+
+  // A helper function to send a tab key to the frame and wait for a state
+  // changed message.
+  auto press_tab_and_wait_for_text_input_state_change =
+      [contents](RenderWidgetHostImpl* rwh) {
+        scoped_refptr<TextInputStateChangedMessageFilter> filter =
+            new TextInputStateChangedMessageFilter(rwh);
+        SimulateKeyPress(contents, ui::VKEY_TAB, false, false, false, false);
+        filter->WaitUntilTextInputStateChanges();
+      };
+
+  // Send focus to the first input field
+  press_tab_and_wait_for_text_input_state_change(root_rwh);
+  EXPECT_EQ(ui::TEXT_INPUT_TYPE_TEXT, root_rwhv->text_input_state()->type);
+  EXPECT_EQ("first", root_rwhv->text_input_state()->value);
+
+  // Verify the top-level state is changed.
+  EXPECT_EQ("first", web_contents()->GetTextInputState().value);
+
+  // Send focus to the input field in frame b.
+  press_tab_and_wait_for_text_input_state_change(child_b_rwh);
+  EXPECT_EQ(ui::TEXT_INPUT_TYPE_TEXT, child_b_rwhv->text_input_state()->type);
+  EXPECT_EQ("second", child_b_rwhv->text_input_state()->value);
+
+  EXPECT_EQ("second", web_contents()->GetTextInputState().value);
+
+  // Send focus to the input field in frame c.
+  press_tab_and_wait_for_text_input_state_change(child_c_rwh);
+  EXPECT_EQ(ui::TEXT_INPUT_TYPE_TEXT, child_c_rwhv->text_input_state()->type);
+  EXPECT_EQ("third", child_c_rwhv->text_input_state()->value);
+
+  EXPECT_EQ("third", web_contents()->GetTextInputState().value);
+
+  // Send focus to the last input field in top frame.
+  press_tab_and_wait_for_text_input_state_change(root_rwh);
+  EXPECT_EQ(ui::TEXT_INPUT_TYPE_TEXT, root_rwhv->text_input_state()->type);
+  EXPECT_EQ("fourth", root_rwhv->text_input_state()->value);
+
+  EXPECT_EQ("fourth", web_contents()->GetTextInputState().value);
+}
+
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
+                       TextInputStateChangesAfterRendererCrashes) {
+  GURL main_url(
+      embedded_test_server()->GetURL("a.com", "/page_with_iframe.html"));
+  NavigateToURL(shell(), main_url);
+  WebContentsImpl* contents = web_contents();
+
+  FrameTreeNode* root = contents->GetFrameTree()->root();
+
+  FrameTreeNode* child = root->child_at(0);
+  GURL child_url(embedded_test_server()->GetURL(
+      "b.com", "/textinput/page_with_input.html"));
+  NavigateFrameToURL(child, child_url);
+  EXPECT_TRUE(WaitForRenderFrameReady(child->current_frame_host()));
+
+  // Verify that the text input state is initially none.
+  EXPECT_EQ(ui::TEXT_INPUT_TYPE_NONE, contents->GetTextInputState().type);
+
+  auto press_tab_and_wait_for_state_change =
+      [contents](RenderWidgetHostImpl* rwh) {
+        scoped_refptr<TextInputStateChangedMessageFilter> filter =
+            new TextInputStateChangedMessageFilter(rwh);
+        SimulateKeyPress(contents, ui::VKEY_TAB, false, false, false, false);
+        filter->WaitUntilTextInputStateChanges();
+      };
+
+  auto crash_renderer_and_wait_for_input_state_none = [contents](
+      RenderProcessHost* host) {
+    RenderProcessHostWatcher crash_observer(
+        host, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+    host->Shutdown(0, false);
+    crash_observer.Wait();
+
+    // We need to wait until the actual text input state update occurs.
+    while (contents->GetTextInputState().type != ui::TEXT_INPUT_TYPE_NONE) {
+      scoped_refptr<MessageLoopRunner> loop_runner_ = new MessageLoopRunner();
+      BrowserThread::PostDelayedTask(BrowserThread::UI, FROM_HERE,
+                                     loop_runner_->QuitClosure(),
+                                     base::TimeDelta::FromMilliseconds(0LL));
+      loop_runner_->Run();
+    }
+  };
+
+  // Press a tab key to focus the <input> and verify that the top level
+  // WebContents sees it.
+  RenderWidgetHostImpl* child_rwh =
+      child->current_frame_host()->GetRenderWidgetHost();
+  press_tab_and_wait_for_state_change(child_rwh);
+  EXPECT_EQ(ui::TEXT_INPUT_TYPE_TEXT, contents->GetTextInputState().type);
+
+  // Crash the renderer and wait until WebContentsImpl has updates the
+  // state.
+  RenderProcessHost* child_process = child_rwh->GetProcess();
+  crash_renderer_and_wait_for_input_state_none(child_process);
+
+  // Now repeat the same test for the top level RWHV.
+  // First remove the <iframe> and append an <input>
+  EXPECT_TRUE(ExecuteScript(contents,
+                            "var f = document.querySelector('iframe'); "
+                            "f.parentNode.removeChild(f);"));
+  EXPECT_TRUE(ExecuteScript(
+      contents, "document.body.appendChild(document.createElement('input'));"));
+
+  // Press tab to focus the <input> and observe the state change.
+  RenderWidgetHostImpl* root_rwh =
+      root->current_frame_host()->GetRenderWidgetHost();
+  press_tab_and_wait_for_state_change(root_rwh);
+  EXPECT_EQ(ui::TEXT_INPUT_TYPE_TEXT, contents->GetTextInputState().type);
+
+  // Crash the tab renderer and observer the input state going back to none.
+  RenderProcessHost* host_process = root_rwh->GetProcess();
+  crash_renderer_and_wait_for_input_state_none(host_process);
+}
+
 // Test that a cross-origin iframe can be blocked by X-Frame-Options and CSP
 // frame-ancestors.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        CrossSiteIframeBlockedByXFrameOptionsOrCSP) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a)"));
   NavigateToURL(shell(), main_url);
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Add a load event handler for the iframe element.
   EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
                             "document.querySelector('iframe').onload = "
                             "    function() { document.title = 'loaded'; };"));
 
   GURL blocked_urls[] = {
     embedded_test_server()->GetURL("b.com", "/frame-ancestors-none.html"),
     embedded_test_server()->GetURL("b.com", "/x-frame-options-deny.html")
   };
@@ skipping 47 matching lines @@
     EXPECT_EQ(blink::WebSandboxFlags::None,
               root->child_at(0)->effective_sandbox_flags());
   }
 }
 
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScreenCoordinates) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   NavigateToURL(shell(), main_url);
 
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   FrameTreeNode* child = root->child_at(0);
 
   const char* properties[] = {"screenX", "screenY", "outerWidth",
                               "outerHeight"};
 
   for (const char* property : properties) {
     std::string script = "window.domAutomationController.send(window.";
     script += property;
     script += ");";
     int root_value = 1;
@@ skipping 94 matching lines @@
   EXPECT_EQ(b_url, root->current_url());
 
   // Verify that the same RenderViewHost is preserved and that it is no longer
   // in swapped out state.
   EXPECT_EQ(rvh, contents->GetFrameTree()->GetRenderViewHost(
                      root->current_frame_host()->GetSiteInstance()));
   EXPECT_FALSE(rvh->is_swapped_out_);
 }
 
 }  // namespace content